# Security Posture Management

URL: https://avispa.ai/agent-teams/security-posture-management/

Security team

Finds, ranks and drives out exposure across scanners, cloud, identity and endpoints. This team works on prevention, ranking exposure by real-world exploitability rather than CVSS alone.

## Who's on the team

- **Posture Lead** · Lead · Owns the remediation plan and every external commitment.
- **Asset Inventory Analyst** · Keeps an authoritative asset inventory with per-source coverage.
- **Cloud Posture Engineer** · Finds attack paths and toxic combinations in cloud configuration.
- **Endpoint Posture Engineer** · Tracks endpoint coverage and configuration drift.
- **Identity Posture Analyst** · Reports MFA coverage honestly, with exclusions listed.
- **Remediation Coordinator** · Runs remediation campaigns and the risk-exception register.
- **Vulnerability Analyst** · Enriches findings with CVE, EPSS and KEV context.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- 8 of its 10 connectors are read-only.
- Every external commitment passes an approval gate the Posture Lead owns.
- Risk exceptions are registered with an owner, a compensating control and an expiry date.

**More: when and where it works, and what it documents**

## When it works

- **Daily Critical Exposure Triage** · Weekdays at 08:00
- **Monthly Exception Expiry Review** · The 1st of each month at 11:00
- **Monthly Identity Posture Review** · The 1st of each month at 10:00
- **Quarterly Posture Executive Report** · The 1st of each quarter at 09:00
- **Weekly Asset Coverage Gap Check** · Wednesdays at 09:00
- **Weekly Remediation SLA Review** · Mondays at 10:00

Routines arrive switched off. You turn each one on.

## Where it works

- Jira
- Axonius
- CrowdStrike Falcon
- Entra ID (read)
- Intune
- Qualys VMDR
- runZero
- Slack
- Tenable
- Wiz

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- An asset inventory with coverage per source.
- A risk-exception register, every entry owned and dated.
- Daily critical exposure triage and a quarterly executive report.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: SOC Detection & Triage](https://avispa.ai/agent-teams/soc-detection-triage/)

## Onboard Security Posture Management with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)